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Summary  of  Accomplishments:  1Q93 


Software  Project  Measurement  Project  members  completed  the 
document  entitled  “Measurement  Definitions  for  Department  of 
Defense  Software  Programs:  Recommendations  for  an  Initial  Core  Set.” 

This  quarter,  Software  Process  Definition  Project  members  completed 
the  transition  of  the  Software  Technology  for  Adaptable,  Reliable 
Systems  Program  and  SEI  Process  Asset  Library  to  ASSET,  an 
electronic  software  engineering  asset  repository. 


This  section  provides  a 
summary  of 
accomplishments  from 
January  —  March  1993 


Capability  Maturity  Model  Project  members  completed  Version  1.1  of 
the  CMM. 


The  first  edition  of  the  RMA  handbook  was  completed  and  will  be 
published  by  Kluwer  Academic  Publishers  in  the  summer  of  1993. 

The  paper  entitled  “Multimedia  Computing:  Applications,  Designs, 
and  Human  Factors"  will  appear  in  User  Interface  Software. 

This  quarter.  Organization  Capability  Development  staff  conducted  the 
“Managing  Technological  Change”  course  for  executives  for  Army 
Materiel  Command  and  the  Air  Force  Materiel  Command. 

The  technical  report  entitled  Academic  Legitimacy  of  the  Softumre 
Engineering  Discipline  was  published  this  quarter. 

Academic  Education  Project  members  conducted  faculty  development 
workshops  in  conjunction  with  the  24th  ACM  Special  Interest  Group 
on  Computer  Science  Education  Technical  Symposium  on  Computer 
Science  Education. 


Software  Construction  with  Ada  was  released  as  a  new  Academic 
Series  course. 

The  curriculum  module  Specification  and  Verification  of  Concurrent 
Software  was  released  this  quarter. 

The  next  two  Visitor’s  Days  are  scheduled  for  27  May  and  18 
November  1993. 

The  SEI  will  host  the  annual  Software  Engineering  Symposium  on  23- 
28  August  1993. 
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Software  Process 


The  Software  Process  Program  focuses  on  improving  the  process  of 
software  development.  Projects  within  the  program  are  assessing  the 
actual  practice  of  software  engineering  in  the  defense  community,  training 
organizations  to  gain  management  control  over  their  software  development 
processes,  supporting  the  use  of  quantitative  methods  and  measures  as  a 
basis  for  process  improvement,  and  developing  improved  methods  for 
software  process  management. 

The  objective  of  the  Software  Process  Measurement  Project  is  to  promote  and 
improve  the  use  of  measurement  in  managing,  acquiring,  and  supporting 
software  systems.  The  project  is  formulating  reliable  measures  of  the  software 
development  process  and  products  to  guide  and  evaluate  development,  lb 
expedite  Department  of  Defense  (DoD)  and  industry  transition,  the  project  is 
actively  working  with  professionals  from  industry,  government,  and  academia  in 
encouraging  organizations  to  use  quantitative  methods  to  improve  their 
software  processes. 

This  quarter,  project  members  prepared  task  plans  and  held  a  task  plan  review 
with  the  project  team  for  the  proposed  software  cost  estimation  improvement 
initiative. 

Strategic  and  technical  industiy  partnering  meetings  were  held  with  Hewlett 
Packard  (HP)  and  IBM  Facilities  Steering  Committee. 

In  support  of  the  measurement  effort  at  Standard  Systems  Center  (SSC),  Gunter 
Air  Force  Base  (AFB),  project  members  held  peer  reviews  of  three  technical 
reports:  Establishing  a  Software  Measurement  Process,  Measurement  and  the 
Implementation  of  Process  Improvement  Recommendations,  and  Measuring  the 
Benefits  of  Software  Process  Improvement. 

Also  during  this  quarter,  three  site  visits  were  conducted  in  support  of 
measurement  work  at  the  Army  Materiel  Command  (AMC),  Fort  Sill  site  in 
Lawton,  Oklahoma. 

This  quarter,  four  site  visits  were  conducted  in  support  of  the  Naval  Air  Warfare 
Center  (NAWC)  technical  objectives  and  plans  (TO&P)  effort.  Project  members 
participated  in  a  NAWC  Program  Management  Review,  held  by  the  pilot  project. 
A  presentation  of  the  measurement  program  and  results  from  the  data  analysis 
were  well  received. 
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Software  Process 
Definition 


Through  the  project’s  support,  NAWC  was  recognized  as  the  Naval  Air  Systems 
Command  (NAVAIR)  Metrics  Center  of  Excellence.  A  progress  report 
summarizing  the  accomplishments  for  1992  was  also  completed  and  sent  to  the 
sponsor. 

The  project’s  resident  affiliate  from  Siemens  completed  several  case  study  site 
visits.  The  interviews  and  site  visits  were  completed  for  the  initial  ten  sites  in 
Germany  and  the  U.S.  An  overview  of  the  case  study  sites  was  generated  that 
summarized  the  characteristics  of  each  organization.  A  project  review  was  held 
in  January,  when  it  was  decided  that  the  joint  project  between  the  SEI  and 
Siemens  could  provide  initial  methods  for  a  more  broad  SEI  validation  stuJy.  A 
white  paper  was  generated  to  identify  a  basic  set  of  organization  performance 
measures. 

In  response  to  a  request  from  the  Advanced  Research  Projects  Agency  (ARPA), 
the  project  leader  prepared  a  white  paper  entitled  “Software  Measurement: 
Embedding  Quantitative  Principles  into  Software  Engineering.”  The  project 
leader  provided  a  walkthrough  of  the  paper  and  provided  a  presentation  on  the 
current  and  future  activities  of  the  measurement  project  to  Dr.  Ed  Thompson 
and  Dr.  Jack  Kramer  of  ARPA,  and  to  the  Joint  Advisory  Committee. 

Project  members  hosted  a  meeting  with  the  Measurement  Steering  Committee 
to  discuss  the  status  of  current  activities,  future  directions,  and  new  initiatives. 

Members  of  the  measurement  project  held  technical  discussions  with  personnel 
from  Defense  Information  Systems  Agency/Center  for  Information  Management 
to  discuss  SEI  support  for  their  pilot  projects  on  using  the  SEI  measurement 
definition  checklists. 

Project  members  completed  the  report  entitled  “Measurement  Definitions  for 
DoD  Software  Programs:  Recommendations  for  an  Initial  Core  Set,”  which  will 
be  published  in  the  1993  SEI  Technical  Review. 


The  objectives  of  the  Software  Process  Definition  Project  (SPD)  are  to  establish 
the  use  of  defined  processes  for  the  management  and  development  of  software  as 
standard  software  engineering  practice  and  to  advance  the  capabilities  required 
to  define  and  automate  the  software  process  within  an  organization.  A  “defined 
process”  means  that  a  process  is  documented,  supported  by  training,  and 
practiced,  and  that  the  practice,  training,  and  documentation  are  equivalent. 
SPD  project  members  are  exploring  process  definition  methods  and  techniques 
through  collaboration  with  several  SEI  sponsors  including:  Air  Force  SSC; 
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Gunter  AFB;  AMC  at  Picatinny  Arsenal,  Redstone  Arsenal,  Ft.  Monmouth;  and 
Air  Force  Materiel  Command  (AFMC).  The  project  is  also  exploring  advanced 
applications  of  process  definition  technology  through  the  ARPA  Software 
Technology  for  Adaptable,  Reliable  Systems  (STARS)  Program. 

During  this  quarter,  project  members  met  with  the  SSC  command  section  to 
discuss  a  special  report  on  process  improvement  lessons  learned.  Project 
members  also  met  with  the  Software  Engineering  Process  Group  (SEPG)  at  SSC 
to  review  the  results  of  recent  SEPG  process  development  work,  and  to  plan 
future  activities. 

Project  members  completed  a  detailed  analysis  and  review  of  a  configuration 
management  process,  Configuration  Management  Operating  Procedure,  at 
Picatinny  Arsenal.  The  analysis  used  the  process  framework  that  is  based  on  the 
capability  maturity  model  (CMM)  process  framework  as  a  baseline  for 
comparison.  This  framework  contains  process  criteria  for  the  CMM  key  practice 
areas. 

Project  members  continue  to  provide  support  to  the  ARPA/STARS  demonstration 
projects  and  Process  Technology  Transition  Affiliates  (PTTA).  Project  members 
also  continue  to  provide  limited  technical  support  for  the  ARPA  STARS/SEI 
Process  Asset  Library,  which  is  a  joint  effort  between  an  SEI  resident  affiliate 
from  GTE,  STARS  prime  contractors,  and  the  SEI. 

This  quarter,  project  members  completed  the  transition  of  the  STARS/SEI 
Process  Asset  Library  to  ASSET,  an  electronic  software  engineering  asset 
repository.  Project  members  are  supporting  the  development  of  a  prescriptive 
process  model  for  the  STARS/IBM  demonstration  project.  Project  members  also 
met  with  representatives  of  the  STARS  demonstration  project  support  teams 
and  PTTAs  to  establish  joint  activities,  including  the  transition  and  application 
of  various  SPD  products  to  STARS  demonstration  projects  and  PTTAs. 


The  Capability  Maturity  Model  Project  maintains  a  model  describing  how 
organizations  can  improve  their  software  process  maturity.  This  model  will  be 
continuously  updated  with  the  state  of  the  art  as  it  evolves  in  software 
engineering,  total  quality  management,  and  other  relevant  areas  of 
improvement.  It  will  elaborate  on  software  development  practices  that  provide 
clear  strategies  for  capability  maturity  growth  and  improvement. 

Version  1.1  of  the  CMM  was  completed  this  quarter.  CMM  vl.l  is  now  available 
by  FTP  over  the  Internet;  paper  copies  have  been  mailed  to  the  members  of  the 
CMM  Correspondence  Group  and  submitted  to  the  normal  distribution  channels 
(Research  Access,  Inc.;  National  Technical  Information  Service;  and  the  Defense 
Technical  Information  Center). 


Capability  Maturity 
Model 
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Empirical  Methods 


The  Empirical  Methods  Project  develops,  evaluates,  and  validates  products  (e.g., 
questionnaires  and  tests,  methods,  and  models)  for  use  in  baselining  and 
measuring  software  process  improvement. 


Prototype  process  maturity  questionnaires  based  on  the  CMM  were  developed 
in  conjunction  with  the  release  of  the  CMM  vl.l.  Usability  testing  of  these 
maturity  questionnaires  (MQ)  began  in  March  and  will  be  completed  in  the  third 
quarter.  The  MQs  will  incorporate  the  usability  data  collected  from  268  people 
in  8  organizations  during  1992.  The  SEI  is  testing  the  vl.l  MQ  prototypes  in 
several  industry  and  government  organizations  to  improve  MQ  clarity  and 
usability.  Project  members  are  working  with  the  Software  Process  Assessment 
(SPA)  Project  and  SPA  Associates  in  pilot  and  field  testing  of  questionnaires  in 
the  updated  SPA  method. 

This  quarter,  Empirical  Methods  staff  members  developed  alpha  versions  of 
questionnaires.  These  questionnaires  will  capture  consistent  information  to: 

•  Determine  the  scope  of  SPAs  and  Software  Capability  Evaluations  (SCEs). 

•  Help  with  selecting  projects  to  include  in  a  SPA  or  SCE. 

•  Collect  information  about  the  people  completing  the  maturity 
questionnaires  for  use  in  efficient  planning  of  the  on-site  period  for  SPAs  and 
SCEs. 

The  questionnaires  are  also  being  field  tested  with  the  SPA  method  update. 

Empirical  Methods  staff  members  are  collaborating  with  a  resident  affiliate  from 
Pacific  Bell  to  prototype  an  instant  profile  product,  which  is  a  supplemental 
appraisal  method  to  check  software  process  improvement  between  SPAs.  This 
joint  product  development  effort  began  in  early  1992  and  resulted  in  pilot  and 
division-wide  implementation  of  the  instant  profile  within  Pacific  Bell  during 
1992. 


Software  Process 
Assessment 


The  Software  Process  Assessment  (SPA)  Project  helps  organizations  improve 
their  software  development  process  by  providing  a  structured  method  for 
assessing  their  current  practice,  as  well  as  continuously  improving  the 
assessment  method  and  ensuring  its  focus  on  organizational  process 
improvement.  The  objectives  of  the  assessment  method  are  to  understand  an 
organization's  current  practices;  identify  key  areas  for  improvement,  utilizing 
the  SEI  process  maturity  model  as  a  framework;  and  help  the  organization 
initiate  those  improvements. 
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This  quarter,  SPA  project  members  provided  authorized  assessment  coaching 
services  to  an  existing  TO&P  client,  AMC  at  Fort  Leavenworth,  Kansas.  In 
addition,  project  staff  prepared  materials  for  and  sponsored  the  delivery  of 
assessment  training  to  24  additional  personnel  from  the  existing  licensed 
organizations. 

SPA  project  members  completed  the  first  draft  of  the  updated  SPA  method  to 
include  the  use  of  the  CMM  vl.l  in  its  process.  The  updated  method  was 
exercised  extensively  in  an  SEI  internal  simulation.  It  was  then  updated  based 
on  lessons  learned  from  the  simulation  exercise,  then  successfully  used  in  a  full 
external  assessment. 

During  this  quarter,  SPA  staff  continued  to  consult  with  various  industry  and 
government  software  organizations  that  are  involved  in  process  improvement 
activities  and  assessments. 


The  Software  Capability  Evaluation  (SCE)  Project  defines,  develops,  and  evolves 
a  method  which  helps  government  acquisition  organizations  evaluate  the 
capability  of  contractors  to  develop  and  maintain  software.  SCE  is  a  method  for 
evaluating  the  software  process  of  an  organization  to  gain  insight  into  its 
software  development  capability.  Project  members  document  the  method,  train 
the  software  community  in  its  use,  develop  guidance  materials  to  support  the  use 
of  the  method,  and  pilot  the  method  with  users.  Significant  effort  is  also 
expended  communicating  with  the  software  community  about  the  SCE  method. 


This  quarter,  SCE  and  SPA  project  leaders  jointly  developed  a  document  entitled 
“Requirements  for  a  Common  Rating  Framework  for  CMM  Based  Appraisal 
Methods.”  The  requirements  outlined  in  this  document  apply  to  CMM-based 
appraisal  methods  such  as  SCE  and  SPA.  Comments  on  the  requirements 
document  have  been  received  from  the  SCE  Advisory  Board  and  are  being 
incorporated  into  the  Version  1.0  document.  An  SEI  development  team  is  using 
this  as  a  working  document  in  creating  a  new  rating  method  for  use  in  these 
methods. 

A  working  draft  of  the  revised  “SCE  Method  Description”  document  (MDD)  was 
completed  and  reviewed  by  the  SCE  Advisory  Board  for  review.  Comments 
indicate  that  a  significant  improvement  has  been  made  in  the  product  since  the 
last  draft  was  reviewed.  This  will  be  the  first  public  documentation  of  SCE 
available  to  the  entire  software  community.  The  next  draft  will  go  to  the  SCE 
Review  Group  for  further  review  by  the  community. 


Software  Capability 
Evaluation 
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A  needs  document  and  specification  development  plan  have  been  created  for  an 
Electronic  lbol  Assistant.  Both  documents  are  part  of  an  effort  to  create 
automated  support  tools  for  CMM-based  appraisal  methods. 


The  project  configuration  management  system  was  updated  in  accordance  with 
the  comments  and  suggestions  that  the  SCE  Advisory  Board  provided.  A 
framework  for  the  evolution  of  the  method  (the  Structured  Transition  Approach) 
was  provided  to  the  SCE  Advisory  Board  and  accepted  as  a  sound  framework  for 
systematically  evolving  the  method.  The  board  requested  more  details  about 
implementing  the  framework.  These  details  will  be  presented  at  the  next 
meeting. 


Development  of  the  “Guide  for  Implementing  SCE  on  Software  Intensive 
Acquisitions”  continued.  The  customer  is  referring  to  this  tailored  product  as  the 
“Implementation  Procedures  Document.”  Comments  have  been  received  from 
the  Air  Force  customer  for  this  product  and  they  were  incorporated  into  the 
guide.  The  guide  is  ir.  final  review  and  edit  with  the  customer. 


A  meeting  was  held  with  Defense  Systems  Management  College  (DSMC) 
concerning  the  SCE  Train  the  Trainers  Course.  DSMC  cannot  proceed  in 
developing  the  course  with  the  SEI  until  a  DoD  agency  provides  direction  and 
funding  to  them  to  help  make  this  happen. 

The  SCE  team  training  course,  scheduled  for  February,  was  canceled  because  of 
shifting  schedules.  Teams  planned  for  February  will  attend  the  April  team 
training.  Team  training  was  conducted  in  March  at  Electronic  Systems  Center 
(ESC)  Hanscom  AFB.  More  than  20  individuals  were  trained  on  four  teams.  One 
team  was  from  a  non-DoD  agency. 


Project  members  conducted  a  one-day  SCE  overview  seminar  at  the  SEI  in 
February.  Approximately  25  participants  attended. 


Project  members  supported  DSM^  instructors  in  delivering  a  module  on  SCE 
during  the  Program  Managers  Course  (PMC)  at  DSMC.  DSMC  instructors  now 
teach  this  overview  material  independently.  This  module  will  become  a  standard 
part  of  the  PMC.  Also,  a  project  member  presented  modules  on  SCE  at  the  DSMC 
Management  of  Software  Acquisition  Course.  This  is  a  standard  offering. 


The  two-hour  SCE  Overview  was  presented  to  the  Defense  Logistics  Agency 
Software  In-Plant  Quality  Evaluation  Conference  in  February. 
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A  series  of  meetings  was  held  to  review  the  status  and  plans  for  the  remainder 
of  the  current  Computer  Resource  Tfechnology  Transition  Program  (CRTTP) 
TO&P.  Several  deliverables  were  provided  to  the  CRTTP  under  a  TO&P: 


•  One  project  member  observed  the  Joint  Software  Tfechnology  for  Adaptable, 
Reliable  Systems  (JSTARS)  program  SCE  conducted  March  22-26.  A  lessons 
learned  report  was  delivered  to  the  JSTARS  office  in  March.  Also, 
recommended  changes  to  the  Award  Fee  Plan  were  delivered  to  the  customer 
in  February. 

•  A  project  member  continued  direct  support  of  the  SCE  National 
Oceanographic  and  Atmospheric  Sciences  Agency  pilot  partner.  He 
forwarded  example  Request  *or  Proposal  language  to  the  program  office  focal 
point  for  executing  a  contract  modification  to  allow  the  conduct  of  an  SCE. 


During  this  quarter,  several  SCE  site  visits  were  observed  by  project  members. 
Two  project  members  advised  and  observed  a  company-internal  SCE  by  one  of 
the  SEI's  affiliate  organizations.  This  was  the  beginning  of  moving  the  SCE 
method  towards  supporting  industry  appl;  nations  of  the  method. 


The  SCE  Advisory  Board  met  in  February.  The  SCE  Review  Group  was  formed 
in  February.  The  review  group  consists  of  32  individuals,  including  the  8 
Advisory  Board  members,  who  represent  their  organizations  in  reviewing  SCE 
method  products. 


The  SCE  Navy  resident  affiliate  presented  an  SEI  Overview  to  his  home 
organization,  Naval  Surface  Warfare  Center.  The  presentation  was  given  to  the 
Cepter  Board  of  Directors  and  to  the  Department  Board  of  Directors. 


Work  continued  on  generating  potential  TO&P  or  client  relationships  with 
several  non-DOD  agencies,  including  the  Defense  Logistics  Agency,  the  Coast 
Guard,  the  FBI,  the  General  Services  Administration,  the  Internal  Revenue 
Service,  and  the  SDIO. 

SCE  project  members  continued  to  support  efforts  to  develop  DoD  policies  on  the 
use  of  SCE.  Project  members  have  also  been  supporting  efforts  for  the  United 
States  Air  Force  (USAF),  and  with  AMC  and  ESC  policy  planning  groups.  A 
“Best  Practices”  letter  signed  by  the  ESC  commander  in  March  strongly 
encouraged  ESC  program  managers  to  use  the  SCE  method  on  their  programs. 
The  ESC  Systems  and  Software  Design  Center  is  the  designated  focal  point  for 
SCE  implementation  at  ESC. 
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Process  Program 
Reports 

January  —  March  1993 


The  SCE  project  continued  to  support  an  AFMC  working  group  that  is  chartered 
to  investigate  how  current  evaluation  methods  used  by  the  USAF  (including 
SCE)  might  be  merged  into  one  technique.  Various  product  materials  have  been 
sent  to  the  group  mid  hands-on  work  developing  the  Software  Development 
Capability  Evaluation  work  products  has  been  provided. 


Capability  Maturity  Model  for  Software,  Version  1.1 
(CMU/SEI-93-TR-24) 

Key  Practices  of  the  Capability  Maturity  Model,  Version  1.1 
(CMU/SEI-93-TR-25) 


For  information  about  obtaining  copies  of  SEI  reports,  see  page  34. 
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Real-Time  Distributed  Systems 


Th8  goal  of  the  Real-Time  Systems  Program  is  to  improve  the 
development  of  real-time  distributed  systems  by  integrating  software 
engineering  with  systems  engineering  and  reducing  the  risk  associated 
with  new  technology. 


The  Rate  Monotonic  Analysis  for  Real-Time  Systems  (RMARTS)  Project  aims  to 
ensure  that  rate  monotonic  analysis  (RMA)  and  scheduling  algorithms  become 
part  of  the  standard  practice  for  designing,  building,  troubleshooting,  and 
maintaining  real-time  systems.  RMA  helps  engineers  understand  and  predict 
the  timing  behavior  of  hard  real-time  systems  to  a  degree  not  previously 
possible. 


Rate  Monotonic 
Analysis  for 
Real-Time  Systems 


This  quarter,  the  first  edition  of  a  handbook  on  RMA  was  delivered  to  the 
publisher.  The  handbook,  entitled  A  Practitioner’s  Handbook  for  Real-Time 
Analysis:  Guide  to  Rate  Monotonic  Analysis  for  Real-Time  Systems,  will  be 
published  by  Kluwer  Academic  Publishers  in  the  summer  of  1993.  The  handbook 
codifies  the  principles  of  RMA  in  a  manner  that  is  easily  accessible  to  real-time 
systems  practitioners. 


The  handbook  is  organized  into  four  parts: 

1.  Introduction.  This  part  provides  an  introduction  to  the  organization  of  the 
handbook  and  a  tutorial  that  acquaints  the  reader  with  the  fundamentals  of 
RMA 

2.  Foundations.  This  part  contains  foundation  material  for  applying  RMA,  a 
framework  for  standardizing  the  description  of  real-time  situations,  and  the 
analytical  techniques  for  computing  schedulability  results. 

3.  Real-Time  Situations.  This  part  is  the  core  of  the  handbook.  It  contains  a 
collection  of  small,  self-contained  modules,  each  of  which  describes  a 
situation  that  a  practitioner  might  encounter  as  part  of  a  larger  system. 

4.  Case  Studies.  This  section  contains  two  case  studies  that  illustrate  how  to 
apply  RMA  knowledge  contained  in  the  rest  of  the  handbook  to  realistically 
complex  systems. 


Delivery  of  the  handbook  concludes  the  work  of  the  RMARTS  Project. 
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Ada  9X  —  Review 


Real-Time  Simulators 


The  SEI  is  supporting  the  revision  of  the  Ada  programming  language  in  a 
variety  of  ways.  One  member  of  the  technical  staff  is  a  participant  in  the  Ada  9X 
Distinguished  Reviewers  Group,  which  is  responsible  for  reviewing  the  ongoing 
revision  work.  This  group  meets  periodically  to  review  the  progress  of  the 
revision.  Another  staff  member  chairs  the  Ada  Compiler  Validation  Capability 
Review  Tteam,  which  is  responsible  for  reviewing  the  direction  and  content  of  the 
test  suite  that  will  be  used  to  validate  Ada  9X  compilers.  The  SEI  also  supports 
outside  experts  who  participate  in  the  Ada  9X  effort  as  distinguished  reviewers 
and  as  Ada  Compiler  Validation  Capability  Review  Team  members.  Finally,  the 
SEI  provides  electronic  mailing  facilities  to  the  Ada  9X  project  and  to  the  Ada 
Joint  Program  Office,  facilitating  communication  among  the  various  groups 
interested  in  the  Ada  standard  and  its  revision. 

This  quarter,  meetings  of  both  review  groups  were  held,  and  documents 
pertaining  to  the  efforts  were  reviewed. 


Real-time  simulators,  especially  flight  simulators,  have  traditionally  used  a 
software  architecture  that  is  optimized  for  efficiency.  The  focus  on  efficiency  has 
complicated  the  achievement  of  certain  types  of  functionality  and  has  caused 
severe  problems  in  maintaining  and  modifying  software.  Understanding  the 
design  tradeoffs  involved  in  emphasizing  certain  non-functional  qualities  like 
the  ability  to  maintain  and  modify  will  enable  designers  to  develop  model 
software  architectures  that  satisfy  these  qualities,  thereby  improving  the 
process  of  developing  real-time  simulators. 

The  goals  of  the  Real-Time  Simulators  Project  are  to: 

•  Extend,  validate,  and  document  flight  simulator  and  other  real-time 
simulator  architectures  in  a  form  that  is  accessible  to  practitioners  and 
acquisition  personnel. 

•  Understand  and  codify  the  relationship  between  non-functional  quality 
goals  and  simulator  software  architectures. 


This  quarter,  project  members  delivered  a  draft  of  the  first  two  parts  of  a 
guidebook  on  the  air  vehicle  portion  of  flight  simulators  to  the  Air  Force 
Aeronautical  Systems  Center  (ASC)  Program  Office  for  Simulators  and  Training. 
The  guidebook  will  contain  20  chapters  and  several  appendices,  which  will 
provide  examples  produced  from  the  development  of  the  T39A  trainer.  The 
remainder  of  the  guidebook  will  be  completed  in  1993. 
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Project  members  conducted  a  focus  group  with  personnel  from  the  National 
Security  Industrial  Association  (NSIA).  The  group  reviewed  the  draft  and 
suggested  improvements. 

Project  members  produced  a  report  for  the  Defense  Modeling  and  Simulation 
Office.  The  report  describes  the  essential  characteristics  of  three  solutions  to 
problems  within  the  DoD  simulation  domain:  structural  models,  aggregate  level 
simulation  protocol,  and  distributed  interactive  simulation. 


The  Dependable  Real-Time  Software  Project  addresses  the  need  for 
predictability  and  dependability  in  embedded  computing  applications.  Examples 
of  embedded  computing  applications  are  distributed  process  control  for  advanced 
manufacturing,  multimedia  high-performance  networks,  medical  equipment, 
and  defense  systems. 

The  three  major  tasks  of  this  combined  project  are  to: 

1.  Investigate  the  use  of  analytical  redundancy  for  application-level  fault 
tolerance.  Currently,  defects  in  complex  software  account  for  most  system 
failures.  This  software  architecture  uses  simple  and  well-understood 
software  to  guarantee  a  baseline  solution  and  an  envelope  within  which 
solutions  from  complex  software  must  lie.  The  architecture  enables  complex 
software  with  residual  defects  to  improve  baseline  performance  without 
crashing  systems. 

2.  Combine  system-level  fault  tolerance  with  RMA.  The  development  and 
transition  of  generalized  RMA  theory  has  been  cited  as  a  success  in  the  DoD 
1991  Software  Strategy  Plan  and  in  the  1992  National  Research  Council 
report  entitled  A  Broader  Agenda  for  Computer  Science  and  Engineering. 
However,  current  technology  for  system  fault  tolerance  still  assumes  the  use 
of  the  old  cyclic  executive  approach  as  the  basis  of  timing  control. 

3.  Develop  a  framework  for  structuring,  classifying,  and  disseminating  fault 
tolerance  technology  in  cooperation  with  government  agencies,  universities, 
and  industry. 


Dependable  Real-Time 
Software  Systems 


SEI  Quarterly  Update  1Q93 


11 


This  quarter,  project  members  demonstrated  software  fault  tolerance 
experimentally,  using  a  refined  version  of  the  simplex  software  architecture  and 
RMA  to  control  multiple  unstable  devices.  Project  members  demonstrated  that 
under  the  control  of  simple  and  reliable  software,  an  unstable  device  can  improve 
its  control  performance  if  new  and  improved  software  is  added  to  the  system. 
This  demonstration  illustrated  that  the  new  technology  can  be  used  to  upgrade 
mission-critical  systems  online.  Furthermore,  the  demonstration  showed  that 
the  simple  software  will  take  over  the  control  if  the  new  software  malfunctions, 
further  illustrating  the  promise  of  this  technology. 

This  quarter,  Dr.  Gary  Koob  and  Mr.  James  Smith  of  the  Office  of  Naval  Research 
visited  the  SEI  for  a  demonstration  of  the  initial  experiments.  Both  were  pleased 
with  the  results  and  indicated  that  they  wanted  the  project  to  continue  the  work 
as  planned.  Representatives  of  Tfexas  Instruments  were  also  present  for  the 
demonstration  and  expressed  interest  in  the  possibility  of  cooperative  efforts. 

Project  Members  prepared  for  the  Dependable  Software  Technology  Exchange, 
funded  by  the  Air  Force  Space  and  Missile  Systems  Center  and  the  Office  of 
Naval  Research.  The  purpose  of  the  technology  exchange  was  to  bring  together 
researchers,  contractors,  and  government  personnel  to  discuss  dependable 
software  needs. 

For  the  first  exchange,  four  topics  were  covered:  formal  methods  and  verification, 
requirements,  operating  system  support,  and  object-oriented  programming  and 
design.  Each  session  included  a  technology  lecture,  an  application  lecture,  and  a 
panel  discussion. 

Work  continued  on  a  fault  tolerance  handbook.  This  handbook  will  be  a  followup 
to  the  Conceptual  Framework  for  System  Fault  Tblerance,  which  was  published 
in  late  1992.  The  handbook  will  present  the  state  of  the  art  in  terms  of  the  state 
of  the  practice  by  discussing  techniques  used  to  achieve  fault  tolerance  and 
showing  where  they  have  been  used  successfully  (or  unsuccessfully)  in  practice. 

The  project  was  represented  at  a  workshop  on  fault  and  error  models  and  at  the 
winter  meeting  of  the  International  Federation  of  Information  Processing  (IFIP) 
Working  Group  10.4  on  Dependable  Systems.  A  project  member  participated  as 
an  invited  panelist  at  the  1993  Reliability  and  Maintainability  Symposium  in 
Atlanta. 
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Transition  Models 


The  Transition  Models  Project  is  developing  a  set  of  methods  and  supporting 
materials  such  as  guidelines  and  checklists  for  planning  and  implementing 
software  technology  transition.  These  materials  will  be  used  by  software 
technology  producers  and  consumers  both  inside  and  outside  the  SEI. 

Transition  Models  staff  members  provide  other  SEI  staff — including 
management — with  education  and  training  on  technology  transition  concepts 
and  approaches.  Additionally,  project  members  provide  limited  consulting  on 
software  technology  transition  to  members  of  SEI  constituencies,  and  maintain 
contact  with  researchers  and  others  interested  in  technology.  transition  from 
business,  government,  and  academic  domains. 

This  quarter,  project  members  participated  in  several  meetings  of  the  Council  of 
Consortia  Technology  Transfer  Models  and  Best  Practices  Working  Groups. 
These  groups  are  developing  a  concept  for  a  product  that  would  provide  online 
resources  and  interactive  guidance  for  technology  transfer  managers. 
Discussions  have  been  held  with  senior  management  from  the  National 
Technology  Transfer  Center,,  who  have  expressed  interest  in  collaborating  in  this 
effort. 

Project  members  are  serving  as  program  chair  and  organizing  chair  for  the 
forthcoming  Working  Conference  on  Diffusion,  Transfer  and  Implementation  of 
Information  Technology.  This  conference  is  sponsored  by  Technical  Committee  8 
(Information  Systems)  of  the  IFIP,  and  will  be  held  at  the  SEI  on  11-13  October. 
The  conference  is  targeted  at  researchers  and  practitioners,  and  will  consider 
the  viability  of  forming  an  IFIP  working  group  in  the  Pittsburgh  area.  During 
this  quarter,  the  program  committee  was  selected  and  the  Call  for  Participation 
and  Papers  was  mailed  and  distributed  over  the  Internet. 

Project  members  held  a  three-day  working  meeting  with  Professor  Natalia 
Juri8to  of  the  Faculdad  Informatics,  Universidad  Politecnica  de  Madrid  (UPM). 
The  SEI  and  the  UPM  have  signed  a  Memorandum  of  Understanding  to 
collaborate  on  a  prototype  system  to  support  change  agents  who  must  introduce 
software  technologies  into  organizations.  Project  members  also  participated  in 
technical  interchange  with  two  members  of  the  ESPRIT  Bootstrap  Project. 

The  project  leader  participated  in  a  two-day  technical  interchange  and  workshop 
on  technology  transfer  at  Siemens  Corporate  Research  Center  in  Princeton,  New 
Jersey.  While  there,  she  met  with  members  of  five  projects  and  discussed  their 
approaches  to  technology  transfer.  During  this  visit,  she  also  presented  a  briefing 
on  SEI  technology  transfer  work. 
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Durra:  A  Task  Description  Language  User's  Manual,  Version  2 
(CMU/SEI-92-TR-36) 


Real-Time 
Distributed 
Systems  Reports 

January  —  March  1993 

For  information  about  obtaining  copies  of  SEI  reports,  see  page  34. 
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Software  Engineering  Techniques 


The  goal  of  the  Software  Engineering  Techniques  Program  is  to  increase 
the  use  of  engineering  knowledge  for  effective  and  efficient  production  of 
large  software-intensive  systems  through  a  model-based  software 
engineering  approach  and  engineered  project  support  environments. 

The  program  consists  of  three  projects.  The  Computer-Aided  Software 
Engineering  (CASE)  Environments  Project  addresses  issues  of 
engineering  of  environments.  The  Application  of  Software  Models  Project 
addresses  the  systematic  creation  and  use  of  models  in  application 
engineering.  The  Software  Engineering  Information  Modeling  Project 
addresses  issues  of  capturing,  representing,  and  making  accessible 
increasing  amounts  of  engineering  information  ranging  from  requirements 
to  engineering  knowledge  typically  found  in  handbooks. 


The  goal  of  the  Application  of  Software  Models  Project  is  to  address  the 
systematic  creation  and  application  of  models  in  application  engineering.  These 
models  form  a  codified  technology  base  of  engineering  knowledge.  Software 
engineers  use  this  technology  base  to  support: 


Applcationaf 
Software  Models 


•  Analysis  of  customers’  needs. 


•  Synthesis  of  solutions  based  on  recognized  commonalities  or  on  variations 
from  previous  solutions. 


•  Reuse  and  re-engineering  of  legacy  software. 


The  approach  to  developing  software  applications  is  a  component  of  the 
model-based  software  engineering  approach  being  promoted  by  the  Engineering 
Techniques  program. 
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This  quarter,  project  members  completed  an  Ada  demo  system  of  Army 
movement  control  and  are  working  with  staff  at  the  Army  Communications  and 
Electronics  Command  to  port  the  application  to  the  Army  Common 
Hardware/Software  Platform.  Project  members  have  provided  Army  contractors 
with  the  software  to  complete  the  port. 

Project  members  delivered  a  set  of  slides  to  the  Army  Director  of  Information 
Systems  for  Command  Control  Communications  and  Computers.  The 
presentation  covers  their  use  of  object-oriented  technologies  and  discusses  how 
these  technologies  can  be  used  within  model-based  software  engineering. 

The  project  is  continuing  to  support  the  Joint  Modeling  and  Simulation  System 
(J-MASS)  by  reviewing  their  executive  design,  simulator  design  criteria,  and 
consistent  use  of  the  structural  model.  A  project  member  reviewed  and  provided 
comments  on  the  latest  version  of  the  J-MASS  version  of  the  object-connection 
update,  the  architectural  design  team  report,  and  the  competitive  risk-reduction 
effort. 

Another  project  member  presented  project  plans  for  the  Strategic  Defense 
Initiative  Office  (SDIO)  tasks  to  Col.  Phelps,  who  supports  the  plan.  Project 
members  have  prepared  a  draft  statement  of  work,  which  is  currently  in  internal 
review.  These  areas  of  work  address  improvements  in  the  development  of 
software  for  battle  management  command,  control,  and  communications 
systems  (BMC3).  The  project  will  support  SDIO  in  developing: 

•  Models  to  understand  and  represent  user  needs  and  variations. 

•  Models  to  support  flexible  architectures  and  designs. 

•  Processes  to  turn  the  models  into  BMC3  applications. 

Project  members  have  discussed  with  HP  the  possibility  of  supporting  the 
restructuring  of  their  Open  Systems  Software  Division  (OSSD).  The  SEI  will 
work  with  several  members  of  the  HP  reuse  department.  This  joint  effort  will 
help  OSSD  define  and  produce  a  technology  base  (domain  kit)  and  establish  a 
process  (flexible  software  factory)  for  using  the  models  in  the  technology  base  for 
software  engineering. 

During  this  quarter,  project  members  met  with  the  Central  Archive  for  Reusable 
Defense  Software  staff  in  West  Virginia  to  explore  possible  interactions.  The 
following  possible  uses  of  this  technology  were  discussed: 

•  Movement  control  models  repository. 

•  Application  development  support  tool. 

•  Joint  domain  analysis  efforts. 
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The  Software  Engineering  Information  Modeling  Project  is  investigating  the 
creation,  maintenance,  and  use  of  models  critical  to  software  engineering.  The 
project  is  conducting  research  into  the  techniques  and  tools  that  will  improve  a 
software  engineer’s  ability  to  capture,  represent,  and  access  reusable  software 
engineering  information,  knowledge,  and  models.  Work  has  begun  to  develop 
pilot  technology  that  facilitates  access  to  software  engineering  information, 
initially  focusing  on  the  improvement  of  requirements  capture  and  analysis. 


Software  Engineering 
Information  Modeling 


This  quarter,  the  project  began  a  joint  effort  with  Tfexas  Instruments  to  develop 
multimedia  engineering  experience  modules.  The  creation  of  these  modules  will 
be  based  on  ongoing  project  work  to  develop  multimedia  knowledge 
representation  techniques. 


Project  members  continue  to  work  with  the  Naval  Supply  Systems  Command  on 
a  TO&P  entitled  “Research  and  Development  of  Advanced  Ibchnology  in  Support 
of  the  Naval  Supply  Systems  Command.”  In  this  effort,  project  members  are 
providing  technical  support  for  system  requirement  determination  and 
evaluation  of  process,  knowledge,  and  data  requirements  to  automatically 
convert  hardcopy  engineering  drawings  into  computer  models. 

As  vice-chair  of  the  Institute  of  Electrical  and  Electronic  Engineers  (IEEE)  Task 
Force  on  Multimedia  Computing  and  chair  of  the  IEEE  Tutorial  and  Workshop 
on  Multimedia  Computing,  the  project  leader  organized  and  held  a  tutorial  and 
workshop  in  March.  One  project  member  presented  “Multimedia  Applications 
and  Abstractions”  at  the  tutorial.  Project  members  attended  the  tutorial  and 
workshop  and  assisted  in  capturing  the  outcomes  of  the  workshop.  The  project 
leader  has  been  named  the  program  chair  for  the  1994  IEEE  International 
Conference  on  Multimedia  Computing  and  Systems. 

The  project  leader  wrote  “Multimedia  Computing:  Applications,  Designs,  and 
Human  Factors.”  This  paper  will  appear  in  User  Interface  Software. 
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CASE  Environments 


The  CASE  Environments  Project  addresses  the  problem  that,  while  a  large 
number  of  software  tools  and  integrating  frameworks  are  currently  available, 
generally  there  is  no  clear  evidence  to  determine  the  precise  impact  of  tools  on 
productivity  and  quality.  In  addition,  the  integration  of  different  tools  is 
problematic,  and  the  organizational  issues  for  adopting  technology  and  the 
support  of  tools  for  an  organization's  software  development  process  are  not  well 
understood  or  generally  agreed  upon. 

This  overall  problem  is  addressed  through  three  general  approaches: 

1.  Developing  conceptual  frameworks  to  understand  tool  integration  and  tool 
adoption  from  the  perspectives  of  technical  mechanisms,  user  services,  and 
organizational  processes. 

2.  Viewing  both  integration  and  adoption  as  design  activities  that  require  an 
analysis  of  the  current  state  and  a  coherent  process  to  move  to  a  desired 
state. 

3.  Verifying  the  conceptual  frameworks  through  small-scale  experiments. 


The  CASE  Technology  Project  has  three  major  task  areas: 

1.  Environment  support  for  configuration  management 

2.  Environment  support  for  integration 

3.  CASE  adoption 


The  project  has  identified  the  state  of  commercial  technology  regarding  software 
configuration  management  (SCM)  support.  This  has  been  captured  through  a 
spectrum  of  concepts  and  observed  paradigms.  Configuration  management  (CM) 
capabilities  can  be  found  in  SCM  tools,  CASE  tools,  and  environment 
frameworks,  each  implementing  its  own  variant  of  some  of  the  concepts.  This 
variety  leads  to  the  need  to  integrate  tools  with  different  SCM  capabilities  into 
a  software  development  environment,  and  the  desire  for  a  unified  SCM  model 
that  can  be  adapted  to  different  processes.  The  result  is  project  activity  in  issues 
of  consolidation  of  SCM  concepts,  integration  of  SCM  and  CASE  tools,  and  SCM 
support  for  the  CM  process  and  its  relationship  to  the  CMM. 
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The  need  for  integration  of  SCM  and  CASE  and  a  number  of  emerging 
environment  technologies  has  led  to  increased  project  activity  on  environment 
architectures  in  support  of  integration.  Various  government  and  industry  efforts 
are  focused  on  environment  reference  models  and  interface  standardization. 
New  insights  are  gained  into  the  problem  of  environment  integration,  taking 
into  consideration  environment  framework  mechanisms,  engineering  service 
concepts  and  information  models,  and  engineering  processes. 

During  the  first  quarter,  project  members  were  major  contributors  to  Version  1 
of  the  Navy’s  Next  Generation  Computer  Resource  Project  Support 
Environments  Standards  Working  Group  reference  model  on  environment 
integration.  In  addition,  project  members  delivered  papers  on  integration  at 
several  workshops,  including  the  Aerospace  Industries  Association  of  America 
Environment  Integration  Workshop  in  Dallas. 

This  quarter,  project  members  continued  to  focus  on  improving  the  ability  of  SEI 
sponsors  and  affiliates  to  make  informed  decisions  about  tool  adoption  and  on 
improving  their  practice  in  the  use  of  CASE  tools.  Project  members  also  provided 
information  to  tool  vendors  on  current  tool  usage  and  gaps  in  current  technology. 


Guide  to  CASE  Adoption 
(CMU/SEI-92-TR-15) 

Control  Integration  Through  Message  Passing  in  a  Software 

Development  Environment 

(CMU/SEI-92-TR-35) 

An  Annotated  Bibliography  on  Integration  in  Software  Engineering 

Environments 

(CMU/SEI-92-SR-08) 

For  information  about  obtaining  copies  of  SEI  reports,  see  page  34. 
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Software  Risk  Management 


Government  Risk 
Management 


The  objective  of  the  Software  Risk  Management  Program  is  to  improve  the 
management  of  risks  that  arise  in  the  development  of  software-intensive 
systems.  Project  members  are  assessing  the  state  of  the  practice  of 
software  risk  management,  developing  methods  and  processes  to  improve 
the  state  of  the  practice,  and  transitioning  these  methods  and  processes 
into  practice. 


The  goal  of  the  Government  Risk  Management  Project  is  to  help  government 
program  managers  become  effective  risk  managers.  Our  goal  is  to  enhance  the 
capability  of  government  agencies  to  successfully  manage  system  acquisition  by: 

1.  Improving  software  engineering  methods  through  the  application  of  a 
software  risk  management  discipline. 

2.  Fostering  the  concept  of  “team”  risk  management. 


The  scope  of  this  project  is  to  develop  and  transition  into  practice  a 
comprehensive  set  of  software  risk  management  products  that  are  aimed  at 
serving  program  managers'  needs  for  effective  support  in  managing  the 
acquisition  and  development  of  large,  software  intensive  systems. 

The  risk  management  product  set  will  focus  on  issues  of  modeling  acquisition 
processes,  developing  risk  management  methods  to  support  these  processes,  and 
improving  communications  about  risk  within  government  and  between 
government  and  its  industrial  contractor  base.  The  primary  emphasis  is  on 
enhancing  the  capability  of  the  customer  and  supplier  team  to  manage  risks  in 
software  development. 

This  quarter,  project  members  formulated  the  concept  of  “team*  risk 
management  that  emphasizes  closer  customer  and  supplier  working 
relationships  to  manage  program  risks.  This  concept  is  being  actively  pursued 
with  strategic  collaborative  partnerships  with  the  Navy  Program  Executive 
Office  for  Anti-Submarine  Warfare,  Air  Assault  and  Special  Missions  Programs, 
(PEO(A)),  and  the  National  Oceanographic  and  Atmospheric  Agency. 
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The  Navy  ^ECXA)  activities  included  continued  detailed  planning  and  evolution 
of  the  aam”  risk  management  process  and  establishing  program  office 
commitments  with  both  the  Navy  and  the  contractor. 

This  quarter,  project  members  supported  the  Navy  PEO(A)  by  conducting  an 
assessment  of  one  of  its  program  contractors.  The  objectives  were  to  demonstrate 
the  value  of  risk  management  and  leave  the  contractor  with  current  risk 
management  methods.  The  results  identified  program-specific  risks  and 
remained  confidential  to  the  contractor. 

The  project  briefed  a  Navy  PECXA)  contractor  on  the  “team”  risk  management 
concept  and  established  commitment  for  collaboration.  Training  is  planned  to 
take  place  during  the  second  quarter. 

Project  members  conducted  a  risk  assessment  with  the  National  Oceanographic 
and  Atmospheric  Agency  Advanced  Weather  Interactive  Processing  System 
Program  Office  and  presented  the  “team”  risk  management  concept  for  potential 
follow-on  collaborative  work.  The  “team”  risk  management  concept  was  also 
presented  to  the  National  Oceanographic  and  Atmospheric  Agency  System 
Program  Office  as  a  way  to  pilot  risk  management  improvement. 

The  project  investigated  risk-driven  acquisition  strategies  and  explored  the 
feasibility  of  using  an  existing  model  Software  Acquisition  Process  Model 
developed  by  the  NAVAIR  as  the  project  starting  point. 

The  project  supported  preparation  for  the  Software  Risk  Management 
Conference  that  took  place  in  March  and  presented  its  concept  of 
customer/supplier  “team”  risk  management  at  the  conference. 

A  project  member  served  as  an  invited  panel  co-chair  at  the  NSIA  Workshop  on 
Re-Engineering.  The  panel  addressed  the  risk  issues  in  re-engineering. 


The  goal  of  the  risk  taxonomy  portion  of  this  project  is  to  develop  the 
taxonomy-based  questionnaire  and  supporting  methods  so  that  both  industry 
and  government  can  easily  integrate  the  methods  into  their  daily  risk 
management  process. 

This  project  is  working  with  the  Government  Risk  Management  Project  and  has 
been  merged  with  the  Industry  Risk  Management  Project  to  ensure  their 
requirements  of  the  taxonomy-based  questionnaire  are  met  and  that  the 
questionnaire  and  supporting  methods  are  integrated  smoothly  into  their 
planned  products. 


Industry  Risk 
Management 
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The  project  is  developing  phase-sensitive  and  domain-sensitive  taxonomy-based 
questionnaires.  Although  the  questionnaire  variance  from  phase  to  phase  and 
from  domain  to  domain  is  small,  it  is  significant  in  identifying  software  technical 
risk.  The  structure  of  the  taxonomy-based  questionnaire  will  remain  unchanged 
over  the  variation  of  the  questionnaire. 

The  taxonomy  method  of  risk  identification  has  evolved  from  a  program  of 
research,  analysis,  and  field  testing.  The  field  testing  validated  the  ability  of  the 
method  to  identify  known  risks  and  also  served  as  a  data-gathering  activity  for 
improving  the  taxonomy  method  including  both  the  questionnaire  itself  and  the 
process  of  applying  the  taxonomy.  The  field  tests  also  exposed  the  taxonomy 
method  to  a  broad  spectrum  of  companies  covering  several  application  d  ■'mains, 
development  methods,  and  risk  management  techniques. 

The  current  version  of  the  taxonomy-based  questionnaire  and  the  risk 
identification  process  are  based  on  11  field  tests  in  9  corporations.  Of  these,  2 
programs  were  in  the  maintenance  phase,  1  was  a  precontract  award,  1  was  at 
alpha  testing,  1  was  in  requirements  analysis,  and  the  remainder  were 
somewhere  between  preliminary  design  review  and  critical  design  review. 
Domain  coverage  of  the  programs  includes  command,  control,  communications, 
and  intelligence;  embedded  satellite  system;  civilian  command  and  control;  and 
information  systems. 
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SEI  Services 


SEI  Services  works  with  other  groups  in  the  SEI  to  develop,  deliver,  and 
transition  services  that  support  the  efforts  of  SEI  clients  to  improve  their 
ability  to  define,  develop,  maintain,  and  operate  software-intensive 
systems.  To  accelerate  the  widespread  adoption  of  effective  software 
practices,  SEI  Services  works  with  client  organizations  that  are  influential 
leaders  in  the  software  community,  promotes  the  development  of 
infrastructures  that  support  the  adoption  of  improved  practices,  and 
transitions  capabilities  to  government  and  commercial  associates  for  use 
with  their  client  organizations. 


The  Computer  Emergency  Response  Tfeam  (CERT)  was  formed  by  DARPA  in 
November  1988  in  response  to  the  needs  exhibited  during  an  Internet  security 
incident.  The  CERT  charter  is  to  work  with  the  Internet  community  to  facilitate 
its  response  to  computer  security  events  involving  Internet  hosts,  to  take 
practice  steps  to  raise  the  community's  awareness  of  computer  security  issues, 
and  to  conduct  research  targeted  at  improving  the  security  of  existing  systems. 


Computer  Emergency 
Response  Team 


This  quarter,  a  CERT  staff  member  received  an  Electronic  Freedom  Foundation 
Pioneer  award  at  the  3rd  Annual  Conference  on  Computers,  Freedom  and 
Privacy.  He  is  one  of  the  two  initial  developers  of  the  software  that  led  to  today's 
USENET. 


Several  members  of  the  CERT  Coordination  Center  attended  the  USENIX 
Technical  Conference,  which  was  held  in  California  in  January.  Conference 
attendance  exceeded  1000.  CERT  presented  a  birds-of-a-feather  session  that  was 
attended  by  60-70  people.  One  of  the  main  items  of  discussion  at  the  session  was 
the  CERT  advisory  concerning  the  keystroke  logging  banner. 

One  staff  member  was  invited  to  chair  a  session  at  the  next  USENIX;  this  session 
will  be  a  review  of  the  Security  Symposium  held  last  year. 
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Also  in  January,  a  CERT  staff  member  attended  the  Workshop  on  Network  and 
Distributed  System  Security,  sponsored  by  the  Privacy  and  Security  Research 
Group  of  the  Internet  Engineering  Task  Force.  The  focus  of  the  meeting  was  on 
implementation  and  design  of  security  technology  for  the  Internet. 

In  addition,  the  CERT  participated  in  the  Security  Alliance  For  Enterprise 
Computing  (SAFE)  meeting  in  New  York.  SAFE  consists  of  Information 
Technology  Consumers  and  Vendors  with  a  commercial  focus  who  are  working 
towards  increasing  the  awareness  of: 

•  the  need  for  secure  computing  in  the  commercial  sector 

•  Unix  security  related  resources 

•  how  Unix  system  technology  can  support  the  security  needs  of  the 
commercial  enterprise  computing  environment. 

This  group  is  working  on  System  Administrator  policy  guidelines  for  corporate 
users  and  Unix  vendors. 

At  the  American  Bankers  Association  National  Security  and  Risk  Management 
Conference  in  Orlando,  the  Coordination  Center  manager  gave  a  presentation 
on  how  to  implement  the  CERT  philosophy. 

Staff  members  attended  the  Federal  Information  Systems  Security  Educators 
Association  meeting  in  Gaithersburg,  Maryland,  in  February,  where  they 
presented  an  overview  of  CERT  training  course  offerings. 

Also  in  February,  a  CERT  staff  member  gave  the  keynote  luncheon  talk  at  a 
symposium  on  Network  Management,  Interconnectivity,  and  Security, 
sponsored  by  the  Association  for  Information  Technologies.  The  symposium  was 
held  in  Madison  Square  Garden  in  New  York  City,  and  attendees  were 
predominately  from  Fortune  500  companies.  A  CERT  staff  member  also  spoke 
on  network  security  at  the  March  Interop  Conference  in  Washington  D.C. 

This  quarter,  several  CERT  members  were  interviewed  by  the  media,  including 
Byte  Magazine  and  Unix  Review. 

A  paper  by  a  CERT  staff  member  was  published  in  the  February  issue  of 
Computers  and  Security :  “Beyond  Preliminary  Analysis  of  the  WANK  and  OILZ 
Worms:  A  Case  Study  of  Malicious  Code." 
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The  Organization  Capability  Development  (OCD)  function  supports  SEI  clients' 
software  process  improvement  efforts  by  helping  them  develop  the  capability  to 
manage  the  organizational  aspects  of  improvement  at  their  sites.  Services 
include  organizational  assessment,  vision  setting  and  dissemination,  strategic 
planning,  transition  infrastructure  development,  executive  consulting, 
cross-functional  team  development,  managing  technological  change,  and 
consulting  skills  for  SEPGs.  The  goal  of  the  function  is  to  provide  to  clients  the 
self-sustaining  capability  of  managing  their  own  long-term  improvement. 


Organization 

Capability 

Development 


This  quarter,  OCD  staff  conducted  the  Managing  Technological  Change  course 
for  executives  at  AMC  (Fort  Monmouth)  and  twice  for  the  AFMC.  In  addition, 
the  Managing  Technological  Change  course  was  presented  to  National 
Aeronautics  and  Space  Administration  (ESIP),  Embedded  Computer  Resources 
Support  Improvement  Program,  and  for  the  public  at  the  SEI. 


This  quarter,  the  “Consulting  Skills  Workshop*  was  held  for  ESIP  and  at  the  SEI 
for  the  public.  Also,  a  workshop  for  senior  management  on  how  to  work 
effectively  with  the  SEPG  was  prototyped  and  conducted  for  AFMC.  Further 
software  process  improvement  support  was  provided  for  the  AFMC,  San  Antonio 
Air  Logistics  Center  (ALC),  Oklahoma  City  ALC,  Aerospace  Guidance  and 
Metrology  Center,  Warner  Robins  ALC,  Ogden  ALC,  AMC,  HP,  and  Xerox. 

OCD  participated  in  the  alpha  test  of  the  updated  SPA  method  conducted  at  an 
AFMC  client  site. 
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SEI  Products 


Academic  Education 


With  the  goal  of  helping  end-users  help  themselves,  SEI  Products  works 
with  other  groups  in  the  SEI  to  develop  an  integrated  set  of  products  and 
services  for  managers,  practitioners,  and  educators.  SEI  Products  ensures 
that  the  results  of  SEI  work  are  in  a  form  that  the  software  community  can 
easily  and  effectively  use  to  improve  software  practice  and  that  educators 
can  use  to  improve  software  engineering. 


The  Academic  Education  Project  focuses  on  the  long-term  development  of  a 
highly  qualified  work  force.  The  project  promotes  and  accelerates  the 
development  of  software  engineering  as  an  academic  discipline.  The  project  is 
developing  model  curricula  and  promoting  the  establishment  and  growth  of 
software  engineering  programs,  as  well  as  working  to  increase  the  amount  of 
software  engineering  content  in  computer  science  programs.  The  project 
produces  educational  materials  that  support  the  teaching  of  software 
engineering  in  universities. 

This  quarter,  project  members  conducted  faculty  development  workshops  in 
conjunction  with  the  24th  Association  for  Computing  Machinery  (ACM)  Special 
Interest  Group  on  Computer  Science  Education  Technical  Symposium  on 
Computer  Science  Education.  Approximately  30  college  and  university 
professors  attended  the  workshops,  the  topics  for  which  included: 

•  Experimental  methods 

•  Engineering  measurement 

•  Software  process  improvement 

•  Software  quality 
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The  Continuing  Education  Project  interacts  with  industry  and  government  to 
increase  the  availability  of  high-quality  educational  opportunities  for  software 
practitioners  and  executives.  The  project  produces  the  Continuing  Education 
Series  and  the  Technology  Series.  The  Continuing  Education  Series  provides 
video-based  courses  designed  for  clients'  in-house  education,  and  executive 
offerings  designed  for  decision  makers  involved  in  improvement  efforts.  The 
Technology  Series  provides  stand-alone  presentations  that  promote  awareness 
of  emerging  issues  and  leading-edge  technologies. 

The  three  currently  offered  executive  courses  ( Software :  Profit  through  Process 
Improvement,  Software  Quality  Improvement,  and  Software  Productivity 
Improvement)  were  updated  to  match  Version  1.1  of  the  CMM. 

The  7th  public  offering  of  a  course  entitled  Software:  Profit  through  Process 
Improvement  was  held  at  the  SEI  early  this  quarter. 

The  course  entitled  Software:  Profit  through  Process  Improvement  was  also 
offered  on-site  to  30  students  at  Redstone  Arsenal  in  Huntsville,  Alabama,  in 
March. 

The  6th  public  offering  of  the  Software  Quality  Improvement  course  was  held  at 
the  SEI  in  February.  Among  two  SEI  affiliates,  participants  from  AT&T,  US 
Treasury  Department,  Computer  Sciences  Corp.,  SWIFT,  and  National  Systems 
&  Research  Co  attended  this  course. 

The  course  Software  Productivity  Improvement  was  taught  in  March  to  students 
from  AT&T,  E-Systems,  and  SWIFT. 

The  first  offering  of  a  new  executive  course,  Software  Risk  Management,  has 
been  scheduled  to  take  place  in  June  29.  Promotional  materials  were  distributed 
to  more  than  200  people  at  the  SEI  Software  Risk  Conference,  which  was  held 
in  March. 

An  instructor  training  session  for  the  Continuing  Education  Series  practitioner 
course  Software  Requirements  Engineering  was  held  in  March.  Three 
organizations  received  the  training  and  course  materials:  ITT,  National  Defense 
University,  and  the  Online  Computer  Library  Center. 

Twenty  videotapes  and  other  materials  from  Software  Project  Management,  a 
Continuing  Education  practitioner  course,  were  purchased  by  Sterling  Software, 
ITT  Research,  and  PARAMAX. 


Continuing  Education 
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This  quarter,  nine  academic  Series  courses  were  sold  during  the  quarter. 


Master  of  Software 
Engineering 


Also  during  this  quarter,  41  Technology  Series  videotapes  were  sold.  The 
currently  available  tapes  are:  Applying  Software  Engineering  Skills  to  Writing, 
by  Linda  Pesante;  Executive  Leadership  for  Software,  by  Watts  Humphrey;  and 
Software  and  Some  Lessons  from  Engineering,  by  Mary  Shaw. 


In  response  to  industry's  growing  demand  for  skilled  software  developers, 
Carnegie  Mellon  University  (CMU)  offers  a  16-month  master's  degree  program 
in  software  engineering.  The  program  is  a  cooperative  effort  of  the  CMU  School 
of  Computer  Science  and  the  SEI.  The  core  of  the  program  is  based  on  the  SEI 
curriculum  recommendations  for  Master  of  Software  Engineering  (MSE) 
programs.  The  MSE  Project  also  produces  the  Academic  Series,  a  set  of 
video-based,  graduate-level  courses  on  software  engineering. 

This  quarter,  a  new  Academic  Series  course  was  released:  Software  Construction 
with  Ada.  An  elective  in  the  Carnegie  Mellon  MSE  program,  the  course  was 
videotaped  in  14  class  meetings  of  60  minutes  each.  It  focuses  on 
component-level  programming  to  achieve  higher  degrees  of  reusability  and 
reliability,  and  thus  increased  productivity.  The  Ada  language  is  used  because  is 
possesses  features  that  are  useful  for  reusing  software  and  for  building 
component  libraries  and  for  its  importance  in  the  area  of  real-time  embedded 
systems.  The  Academic  Series  course  includes  a  set  of  videotaped  lectures  by 
Jorge  Diaz-Herrera  and  an  instructor's  book. 

Also  released  this  quarter  was  a  curriculum  module,  Specification  and 
Verification  of  Concurrent  Software,  which  includes  an  extensively  annotated 
outline  of  the  subject  area,  advice  for  teaching  the  subject,  and  an  annotated 
bibliography. 

Academic  Legitimacy  of  the  Software  Engineering  Discipline,  was  published  as  an  SEI 
technical  report.  This  report  addresses  the  issues  faced  by  software  engineering 
faculty. 

Among  the  core  courses  offered  to  MSE  students  this  semester  are  Software 
Design,  Software  Analysis,  and  Software  Creation  &  Maintenance.  In  addition, 
the  Software  Development  Studio  continues  from  the  fall  semester. 

SEI  Academic  Series  courses  are  also  being  distributed  through  the  National 
Technological  University  (NTU),  which  delivers  courses  by  satellite  to  corporate 
and  government  sites.  For  the  spring  semester,  NTU  is  presenting  Software 
Creation  &  Maintenance  and  Software  Verification  &  Validation. 
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Academic  Legitimacy  of  the  Software  Engineering  Discipline 
(CMU/SEI-92-TR-34) 

Materials  for  Teaching  Software  Inspections 
(CMU/SEI-93-EM-7) 

Lecture  Notes  on  Software  Process  Improvement 
(CMU/SEI-93-EM-08) 

Formal  Specification  and  Verification  of  Concurrent  Programs 
(SEI-CM-27-1.0) 


□  □  □  □  □  □ 

SEI  Products 
Reports 

January  —  March  1993 
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Technology  Transition  Initiatives 


Process  Research 


The  Process  Research  Project  investigates  the  factors  that  limit  software 
development  performance  by  conducting  research  on  the  use  of  software  process 
principles  by  individuals  and  small  teams.  This  research  is  seeking  insight  into 
the  processes,  tools,  and  methods  that  will  be  most  helpful  in  improving  the 
performance  of  software  engineering  professionals. 


The  Process  Research  Project  continues  to  explore  the  use  of  statistical  process 
management  methods  by  individual  software  practitioners.  Early  work  has 
demonstrated  the  potential  value  of  such  methods  in  improving  the  quality, 
productivity,  and  predictability  of  the  work.  With  the  completion  of  Milestone  1 
this  quarter,  the  project  has  moved  from  the  early  exploratory  phase  to 
addressing  the  feasibility  of  more  general  application  of  the  personal  software 
process  (PSP)  method.  Principal  emphasis  has  thus  moved  to  working  with 
academic  and  industrial  groups.  Because  of  the  substantial  changes  required  in 
individual  and  management  attitudes  and  practices,  it  is  expected  that  both 
academic  and  industrial  adoption  of  the  method  will  be  slow.  Work  is  thus 
underway  with  several  groups  with  the  objective  of  gaining  usage  experience 
from  some  of  them  during  1993  and  1994. 


The  principal  focus  of  the  industry  activities  has  been  with  Siemens  Research  of 
Princeton,  New  Jersey,  and  AIS  of  Peoria,  Illinois.  A  visit  was  made  to  Siemens 
in  January  and  to  AIS  in  March.  As  expected,  both  groups  are  making  progress. 
Two  other  industrial  groups  have  also  expressed  interest  in  the  PSP  work. 
Meetings  have  been  arranged  to  take  place  in  the  second  quarter. 


A  professor  at  the  University  of  Idaho  is  currently  teaching  a  course  using 
various  components  of  the  PSP  method.  While  some  U.S.  universities  have 
expressed  interest  in  the  PSP  method,  none  are  yet  actively  planning  to  offer  a 
dedicated  courses  on  the  method.  A  course  proposal  is  being  prepared,  and  an 
effort  will  be  made  to  find  a  university  that  will  offer  the  course  during  the 
1993-1994  academic  year.  Should  the  course  materialize,  it  is  expected  to  require 
a  substantial  amount  of  project  support. 


This  quarter,  the  project  leader  visited  the  Air  Mobility  Command  software 
group  at  Scott  AFB  to  meet  with  senior  management  and  give  a  presentation  on 
software  process  improvement  concepts  and  issues. 

This  quarter,  an  update  of  the  PSP  process  was  completed.  This  PSP  details  the 
lessons  learned  over  the  last  several  months. 
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This  quarter,  the  proposed  IEEE/SEI  Award  for  Process  Achievement  was 
approved  by  the  IEEE  Computer  Society  with  the  project  leader  serving  as 
chairman  of  the  review  committee.  Other  review  committee  members  are  Dr.  Vic 
Basili,  Dr.  Barry  Boehm,  Dr.  Manny  Lehman,  and  Dr.  Bill  Riddle.  The  award  will 
be  jointly  announced  by  the  SEI  and  the  IEEE  and  it  is  expected  to  motivate 
people  to  publicize  their  process  improvement  results.  This,  in  turn,  should 
provide  increasing  evidence  of  the  benefits  of  software  process  improvement. 


The  project  leader  attended  the  2nd  International  Software  Process  Conference 
in  Berlin,  Germany,  to  present  a  technical  p~,*'er.  V  j  project  leader  also 
attended  the  Eighth  International  Software  Pro  Workshop  in  Germany. 
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Program  Development 


The  vision  of  the  Program  Development  Division  (PDD)  is  to  serve 
customer  needs  by  being  the  voice  of  the  customer  to  the  SEI  and  the 
voice  of  the  SEI  to  the  customer.  The  PDD  mission  is  to  understand  the 
key  requirements  of  SEI  customers,  translate  these  into  responsive  SEI 
program  specifications  consistent  with  the  SEI  mission,  and  facilitate  the 
effective  transition  of  best  software  engineering  practice  into  use. 

PDD  accelerates  the  transition  of  new  SEI  software  technologies  and 
methods  by  disseminating  information,  providing  mechanisms  for 
collaboration  and  technology  exchange,  and  offering  customers  the 
opportunity  to  participate  in  technical  interchange  meetings,  workshops, 
and  educational  offerings.  Efforts  used  to  facilitate  this  transition  include 
the  Customer  Relations  information  line,  the  subscriber  program,  the 
resident  affiliate  program,  events  such  as  the  annual  SEI  Software 
Engineering  Symposium  and  Visitor's  Days,  and  distribution  partners. 


The  subscriber  program,  in  effect  since  January  1992,  is  open  to  any  individual 
with  a  U.S.  mailing  address.  Subscribers  receive  regular  publications  such  as 
Bridge  and  the  Annual  Technical  Review ,  a  discount  at  the  annual  SEI  Software 
Engineering  Symposium,  a  10%  discount  on  all  SEI  technical  reports  ordered 
through  Research  Access,  Inc.,  invitations  to  selected  SEI  events  (e.g.,  the 
annual  SEI  Symposium),  and  first  notification  of  SEI  course  offerings.  The  1993 
fee  for  subscribers  is  $100  per  individual  per  year.  The  fee  is  subject  to  change 
in  1994,  as  the  benefits  are  reviewed  and  amended. 

Visitor's  Day  is  hosted  by  the  SEI  three  times  a  year  to  familiarize  software 
practitioners,  managers,  and  educators  with  the  SEI.  The  next  two  Visitor's 
Days  are  scheduled  for  27  May  and  18  November  1993.  Visitors  must 
pre-register;  walk-ins  will  not  be  accommodated.  Registration  forms  are 
available  from  Customer  Relations.  (See  page  34  for  more  information.) 

The  SEI  will  host  the  annual  Software  Engineering  Symposium  on  23-28  August 
1993.  This  symposium  will  take  place  at  the  David  Lawrence  Convention  Center 
in  Pittsburgh  and  the  theme  is  “The  Business  of  Software  Engineering:  The 
Competitive  Edge.”  This  year,  the  symposium  will  have  a  broader  focus  than  it 
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has  had  in  past  years.  The  symposium  will  showcase  a  variety  of  topics  that  are 
important  to  corporate  and  government  organizations  dependent  on  software 
engineering.  The  topics  selected  will  help  software  managers  and  practitioners 
respond  better  to  competition  and  the  changing  environment. 

For  registration  information,  contact: 

Events 

Software  Engineering  Institute 
Carnegie  Mellon  University 
Pittsburgh,  PA  15213-3890 

Phone:  (412)  268-6531 
FAX:  (412)  268-5758 


For  general  symposium  information,  contact  Customer  Relations.  (See  page  page 
34  for  details.) 


The  following  organizations  sponsored  resident  affiliates  in  the  first  quarter  of 
1993: 

Industry  Computer  Sciences  Corporation 
GTE  Government  Systems 
Hughes  Aircraft  Company 
IBM 

Lockheed  Missiles  and  Space  Company,  Inc. 

Pacific  Bell 
Siemens 

Texas  Instruments 


Government  Air  Force  Electronic  Systems  Division 

Navy  Naval  Air  Warfare  Center 

Naval  Surface  Warfare  Center 

Army  Communications-Electronics  Command 

Other  DoD  Defense  Logistics  Agency 

National  Security  Agency 
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How  to  Get  Additional  Information 


For  information  about  purchasing  SEI  publications,  contact  one  of  the 

following  organizations: 

RAI  Research  Access  Inc. 

3400  Forbes  Avenue,  Suite  302 
Pittsburgh,  PA  15213 
Telephone:  1-800-685-6510 
FAX:  (412)  682-6530 

NTIS  National  Technical  Information  Service 

U.S.  Department  of  Commerce 
Springfield,  VA  22161-2103 
Telephone:  (703)  487-4600 

DTIC  Defense  Technical  Information  Center 

ATTN:  FDRA  Cameron  Station 
Alexandria,  VA  22304-6145 
Telephone:  (703)  274-7633 


Some — not  all — SEI  documents  are  available  electronically.  Send  electronic  mail  to 
inf  o-manage@sei  .  emu .  edu  for  information  about  obtaining  documents  via 
anonymous  FTP  on  the  Internet.  Be  certain  to  include  your  telephone  number 
in  the  event  that  we  have  difficulty  contacting  you  by  electronic  mail. 


For  information  on  the  subscriber  program  and  other  SEI  offerings,  contact: 

SEI  Software  Engineering  Institute 

ATTN:  Customer  Relations 
Carnegie  Mellon  University 
Pittsburgh,  PA  15213-3890 
(412)  268-5800 

Internet:  customer-relations@sei.cmu.edu 
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List  of  Acronyms 


ACM 

AFB 

AFMC 

ALC 

AMC 

ARPA 

ASC 

BMC3 

CM 

CMM 

CMU 

CRTTP 

DoD 

DSMC 

ESC 

ESIP 

HP 

IEEE 

IFIP 

J-MASS 

JSTARS 

MDD 

MQ 

MSE 


Association  for  Computing  Machinery 

Air  Force  Base 

Air  Force  Materiel  Command 

Air  Logistics  Center 

Army  Materiel  Command 

Advanced  Research  Projects  Agency 

Aeronautical  Systems  Center 

battle  management  command,  control,  and  communications 
configuration  management 
capability  maturity  model 
Carnegie  Mellon  University 

Computer  Resource  Technology  Transition  Program 
Department  of  Defense 
Defense  Systems  Management  College 
Electronic  Systems  Center 

Embedded  Computer  Resources  Support  Improvement 
Program 

Hewlett  Packard 

Institute  of  Electrical  and  Electronic  Engineers 

International  Federation  of  Information  Processing 

Joint  Modeling  and  Simulation  System 

Joint  Software  Technology  for  Adaptable,  Reliable  Systems 

method  description  document 

maturity  questionnaire 

Master  of  Software  Engineering 
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NAVAIR 


NAWC 

NSIA 

NSUP 

NTU 

OCD 

OSSD 

PDD 

PECXA) 

PMC 

PSP 

PTTA 

RMA 

RMARTS 

SCE 

SCM 

SDIO 

SEPG 

SPA 

SPD 

SSC 

STARS 

TO&P 

UPM 

USAF 


Naval  Air  Systems  Command 
Naval  Air  Warfare  Center 
National  Security  Industrial  Association 
Naval  Supply  Systems  Command 
National  Technological  University 
Organization  Capability  Development 
Open  Systems  Software  Division 
Program  Development  Division 

Program  Executive  Officer  for  Anti-Submarine  Warfare,  Air 
Assault,  and  Special  Missions  Programs 

Program  Managers  Course 

personal  software  process 

Process  Technology  Transition  Affiliates 

rate  monotonic  analysis 

Rate  Monotonic  Analysis  for  Real-Time  Systems 
Software  Capability  Evaluation 
software  configuration  management 
Strategic  Defense  Initiative  Office 
Software  Engineering  Process  Group 
Software  Process  Assessment 
Software  Process  Definition 
Standard  Systems  Center 

Software  Technology  for  Adaptable,  Reliable  Systems 
technical  objectives  and  plans 
Universidad  Politecnica  de  Madrid 
United  States  Air  Force 


List  of  Acronyrns-2 


1Q93 


